© 
Reference: FS50665716 1CcO 
ð 


Information Commissioner's Office 


Freedom of Information Act 2000 (FOIA) 


Decision notice 


Date: 13 June 2017 


Public Authority: Chief Constable of Nottinghamshire 
Constabulary 


Address: Nottinghamshire Police HQ 
Sherwood Lodge 
Arnold 
Nottingham 
NG5 8PP 


Decision (including any steps ordered) 


1. The complainant has requested information about Nottinghamshire 
Police’s use of covert communications data capture technology. 
Nottinghamshire Police would neither confirm nor deny holding any 
information citing the exemptions at sections 23(5) (security bodies), 
24(2) (national security), 30(3) (investigations and proceedings) and 
31(3) (law enforcement) of the FOIA. 


2. The Commissioner’s decision is that sections 23(5) and 24(2) were cited 
correctly and so Nottinghamshire Police was not obliged to confirm or 
deny whether the requested information was held. 


3. The Commissioner does not require any steps to be taken. 
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Background 


4. The request refers to IMSI catchers, “IMSI” being an acronym for 
“International Mobile Subscriber Identity”. According to a response on 
Hansard: 


“Investigative activity involving interference with property or 
wireless telegraphy, such as International Mobile Subscriber 
Identity (IMSI) grabbers, is regulated by the Police Act 1997 and 
the Intelligence Services Act 1994 which sets out the high level of 
authorisation required before the police or Security and intelligence 
agencies can undertake such activity. Use of these powers is 
overseen by the Intelligence Services Commissioner and the Office 
of Surveillance Commissioners. In any case involving the 
interception of the content of a communication, a warrant 
authorised by the Secretary of State under the Regulation of 
Investigatory Powers Act 2000 is required”. 


5. Nottinghamshire Police cited decision notice FS5049944? as evidence to 
support the principle of neither confirming nor denying the use of a 
particular type of surveillance equipment. It also cited a decision issued 
by the Scottish Information Commissioner, 2016002783, which refers 
specifically to IMSI technology. 


Request and response 


6. On 10 October 2016, the complainant wrote to Nottinghamshire Police 
and requested information in the following terms: 


“Please tell me if the force uses any form of 'IMSI catchers' or 'covert 
communications data capture' technology, or any other technology to 
harvest data from mobile devices or using mobile signals (here 


1 http://www. parliament.uk/business/publications/written-questions- 
answers-statements/ written- question/Lords/2014-11-03/HL2602 


? https://ico.org.uk/media/action-weve-taken/decision- 
notices/2013/825162/fs_ 50459944. pdf 


3http: // www. itspublicknowledge.info/ApplicationsandDecisions/Decisions/201 
6/201600278.aspx 
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referred to collectively as catchers). 


Please tell me how any such catcher technology is used by the force 
and how it works. 


How much was spent by the force on any IMSI or CCDC technology in 
your budgets for each of the past three years. 


How many officers make use of it? 


How many arrests have been made by the force in the past six 
months on information acquired by catcher technology?” 


7. Nottinghamshire Police responded on 5 December 2016. It refused to 
confirm or deny holding the requested information, citing sections 23(5), 
24(2), 30(3) and 31(3) of the FOIA. 


8. The complainant asked Nottinghamshire Police to conduct an internal 
review, indicating that he would be willing to modify the request in the 
following ways: in respect of the second point of the request, he was 
willing to accept a “general” explanation as to how the technology works 
and is used. In respect of the fourth point of the request (the number of 
officers making use of the technology), he was willing to substitute 
instead a request to know how many mobile devices had been accessed 
by IMSI catchers in 2016. 


9. Following an internal review Nottinghamshire Police wrote to the 
complainant maintaining its position. 


Scope of the case 


10. The complainant contacted the Commissioner on 31 January 2017 to 
complain about the way his request for information had been handled. 
He asked the Commissioner to consider the application of the 
exemptions cited by Nottinghamshire Police. 


Reasons for decision 


Section 23 - Information supplied by or relating to security bodies 
Section 24 - National security 


11. Under section 23(1), information supplied by or relating to security 
bodies specified in section 23(3) is exempt from disclosure. Information 
which does not fall under section 23(1) is exempt from disclosure under 


Reference: FS50665716 ico. 


12. 


13. 


14. 


15. 


16. 


17. 


18. 


Infọrmation {mine r’s Office 


section 24(1), if it is required for the purpose of safeguarding nationa 
security. 


Sections 23(5) and 24(2) exclude the duty of a public authority to 
confirm or deny whether it holds information which, if held, would be 
exempt under section 23(1) or 24(1) respectively. 


By virtue of section 23(5) the duty to confirm or deny does not arise if, 
or to the extent that, compliance with section 1(1)(a) would involve the 
disclosure of any information (whether or not already recorded) which 
was directly or indirectly supplied to the public authority by, or which 
relates to, any of the bodies specified in section 23(3). 


By virtue of section 24(2) the duty to confirm or deny does not arise if, 
or to the extent that, exemption from section 1(1)(a) is required for the 
purpose of safeguarding national security. 


Nottinghamshire Police considers that both sections 23(5) and 24(2) are 
engaged in this case. The Commissioner does not consider the 
exemptions at section 23(5) and 24(2) to be mutually exclusive and she 
accepts that they can be relied upon independently or jointly in order to 
conceal whether or not one or more of the security bodies has been 
involved in an issue which might impact on national security. 


With regard to section 23(5), Nottinghamshire Police argued that if the 
information specified in the request did exist, it is “highly likely” that it 
would have come from, or be related to, a section 23(3) body. Were it 
the case that absolute certainty of the connection between the 
information and a section 23(3) body was required, this might mean 
that the possibility, however slim, of Nottinghamshire Police holding 
relevant information that was not related to, or supplied by, a section 
23(3) body would undermine its reliance on section 23(5). 


In the Tribunal case The Commissioner of Police of the Metropolis vs 
Information Commissioner (EA/2010/0008) the argument was advanced 
that it was highly likely that any information held by the public authority 
that fell within the scope of the request would have been supplied to it 
by a section 23(3) body and, therefore, section 23(5) was engaged. The 
counterargument was made that only certainty as to the source of the 
information would be sufficient. The Tribunal rejected this 
counterargument and stated: 


“[The evidence provided] clearly establishes the probability that the 
requested information, if held, came through a section 23 body.” 
(paragraph 20) 


The approach of the Commissioner on this point is that she accepts the 
Tribunal view that the balance of probabilities is the correct test to 
apply. This means that for section 23(5) to be engaged, the evidence 
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must suggest to a sufficient degree of likelihood (rather than certainty 
that any information falling within the scope of the request would a 
to, or have been supplied by, a body specified in section 23(3). 


In this case, the Commissioner considers it clear that the subject matter 
of the request - data capture from mobile phones - is within the area of 
the work of bodies specified in section 23(3). This view is strengthened 
by the citation in paragraph 4, above, which states that any use of IMSI 
technology would be regulated by the Police Act 1997 and the 
Intelligence Services Act 1994. 


Nottinghamshire Police has also advised the Commissioner: 


“Police Forces routinely work alongside other law enforcement 
agencies especially with regards to areas of counter terrorism and 
serious and organised crime”. 


The Commissioner accepts that it is likely that, if the information 
described in the request does exist, this would be a field of work which 

is likely to have been conducted in conjunction with, and with the 
knowledge of, other parties within the policing field, and that this type of 
work is likely to include security bodies. 


The test as to whether a disclosure would relate to a security body is 
decided on the normal standard of proof, that is, the balance of 
probabilities. In other words, if it is more likely than not that the 
disclosure would relate to a security body then the exemption would be 
engaged. 


From the above it can be seen that section 23(5) has a very wide 
application. If the information requested is within what could be 
described as the ambit of security bodies’ operations, section 23(5) is 
likely to apply. This is consistent with the scheme of FOIA because the 
security bodies themselves are not subject to its provisions. Factors 
indicating whether a request is of this nature will include the functions of 
the public authority receiving the request, the subject area to which the 
request relates and the actual wording of the request. 


There is clearly a close relationship between the police service and the 
security bodies. It is inevitable that it works closely with security bodies 
in carrying out its role. Therefore, in respect of Nottinghamshire Police’s 
role and the subject matter being requested, the Commissioner finds 
that, on the balance of probabilities, any information about its potential 
use of IMSI technology, if held, could be related to one or more bodies 
identified in section 23(3) of the FOIA. The Commissioner is therefore 
satisfied that Nottinghamshire Police is entitled to rely upon section 
23(5) in the circumstances of this case. 
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As this conclusion has been reached on section 23(5), it is not strictly 
necessary to go on to also consider any other exemptions. However, as 
Nottinghamshire Police also relied on section 24(2), the Commissioner 
has gone on to consider that exemption. 


Section 24(2) provides an exemption from the duty to confirm or deny 
where this is required for the purpose of safeguarding national security. 
Consideration of this exemption is a two-stage process. First, the 
exemption must be engaged due to the requirement of national security. 
Secondly, this exemption is qualified by the public interest, which means 
that the confirmation or denial must be provided if the public interest in 
the maintenance of the exemption does not outweigh the public interest 
in disclosure. 


The Commissioner has already accepted, when finding that section 
23(5) is engaged, that revealing whether or not information is held 
within the scope of the request would reveal information relating to the 
role of the security bodies. The Commissioner also accepts that a 
disclosure that touches on the work of the security bodies would 
consequentially undermine national security. For that reason section 
24(2) is also engaged, as exemption from the duty to confirm or deny is 
required for the purposes of national security. 


Turning to the balance of the public interest, the question here is 
whether the public interest in safeguarding national security is 
outweighed by the public interest in disclosure of the confirmation or 
denial. Clearly, the public interest in safeguarding national security 
Carries very great weight. In order for the public interest to favour 
provision of the confirmation or denial, it will be necessary for there to 
be public interest factors in favour of this of at least equally significant 
weight. 


The view of the Commissioner is that there is some valid public interest 
in confirmation or denial in response to this request. It would increase 
public knowledge regarding the extent, or otherwise, of the use of IMSI 
catchers by Nottinghamshire Police which, in turn, may give an 
indication regarding their use by the police service as a whole. 


The Commissioner considers it to be clearly the case, however, that this 
public interest does not match the weight of the public interest in 
safeguarding national security. This means that her conclusion is that 
the public interest in the maintenance of the exemption provided by 
section 24(2) outweighs the public interest in disclosure of the 
confirmation or denial. 


In view of this finding, and that on section 23(5), Nottinghamshire Police 
was not required to confirm or deny whether it held the information 


© 
Reference: FS50665716 1CO 
ð 


Information Commissioner's Office 


requested by the complainant. The Commissioner has not therefore 
considered the other exemptions cited. 
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Right of appeal 


32. Either party has the right to appeal against this decision notice to the 
First-tier Tribunal (Information Rights). Information about the appeals 
process may be obtained from: 


First-tier Tribunal (Information Rights) 
GRC & GRP Tribunals, 

PO Box 9300, 

LEICESTER, 

LE1 8D} 


Tel: 0300 1234504 

Fax: 0870 739 5836 

Email: GRC@hmcts.gsi.gov.uk 

Website: www. justice. gov.uk/tribunals/qeneral-regulatory- 


chamber 


33. If you wish to appeal against a decision notice, you can obtain 
information on how to appeal along with the relevant forms from the 
Information Tribunal website. 


34. Any Notice of Appeal should be served on the Tribunal within 28 
(calendar) days of the date on which this decision notice is sent. 


Samantha Bracegirdle 

Senior Case Officer 

Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 


